lkml.org 
[lkml]   [2005]   [Oct]   [4]   [last100]   RSS Feed
Views: [more markup]   [less markup]   [headers]   [forward]  
 
Messages in this thread
/
DateTue, 04 Oct 2005 00:28:40 -0400
FromJohn Richard Moser <>
SubjectThe price of SELinux (CPU)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I've heard that SELinux has produced benchmarks such as 7% increased CPU
load.  Is this true and current?  Is it dependent on policy?  What is
the policy lookup complexity ( O(1), O(n), O(nlogn)...)?  Are there
other places where a bottleneck may exist aside from gruffing with the
policy?  Isn't the policy actually in xattrs so it's O(1)?  Where else
would an overhead that big come from aside from a lookup in a table?

....
Why is the sky blue?  Why do you have a mustach?  Why doesn't mommy have
one?  Does she shave it?

At any rate, my personal end goal is a secure high-performance operating
system, as user friendly as Ubuntu, Mandriva, or Win----.  To this end,
I'm (still; a lot of you have seen me before) evaluating the performance
hit of various user and kernel security enhancements like PaX,
ProPolice, various OpenWall/GrSecurity niceness that needs to be divided
out, and of course LSM/SELinux.  Also wondering about that PHKMalloc
thing on openbsd; is it really all that, is it junk, how's it compare to
the recent ptmalloc work, and can it run on Linux for direct benching .
. . but that's off topic.
- --
All content of all messages exchanged herein are left in the
Public Domain, unless otherwise explicitly stated.

    Creative brains are a valuable, limited resource. They shouldn't be
    wasted on re-inventing the wheel when there are so many fascinating
    new problems waiting out there.
                                                 -- Eric Steven Raymond
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
iD8DBQFDQgT4hDd4aOud5P8RAoWBAJ0foEe4JcqDDlb7mMXQ6Z6FjCFjLACfdmJz
+j2lCH7DpTlZK6zUztldEGI=
=RzhA
-----END PGP SIGNATURE-----
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-10-04 02:32    [W:0.350 / U:0.340 seconds]
©2003-2008 Jasper Spaans